defuddle-web-cleaner

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:20 PM UTC
• Version:
  1.0.0

Overview

This is a simple web-article cleanup skill, with no evidence of credentials, persistence, destructive behavior, or hidden high-impact actions.

Safe for normal article-cleaning use. Before processing private pages or copied HTML, confirm whether your agent will use the external defuddle.md service, a local Defuddle CLI, or another parser.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest description says to use the skill whenever a user provides a URL or HTML and wants readable text, markdown, or metadata, and further lists broad use cases like research workflows, note taking, and converting web pages to markdown. This trigger scope is expansive and overlaps with many common requests, without clear boundaries or exclusion examples to limit unintended invocation.

VirusTotal

66/66 vendors flagged this skill as clean.